# Abdul Wasey (w453y)

> Network and firmware engineer from NITK Surathkal, India. Works on
> secure-boot firmware for Qualcomm and OpenWrt platforms, kernel-level
> networking with XDP and eBPF, IPv6 deployment, self-hosted
> infrastructure, and upstream contributions to FRRouting.
> Site: https://w453y.me · Email: awasey8905@gmail.com

## Identity

- Name: Abdul Wasey
- Handle: w453y (consistent across GitHub, LinkedIn, Twitter/X, Reddit, Telegram, Keybase)
- Location: Mangalore, Karnataka, India (IST, UTC+5:30)
- Education: B.Tech, National Institute of Technology Karnataka (NITK), Surathkal, Nov 2022 to May 2026, Metallurgical and Materials Engineering
- Current role: Firmware Engineer at Quantum Networks (https://www.qntmnet.com), Dec 2025 to present, remote

## Site map

- https://w453y.me/: short index, recent writing, selected projects and upstream work
- https://w453y.me/writing/: Writing
- https://w453y.me/projects/: Projects
- https://w453y.me/open-source/: Open Source
- https://w453y.me/work/: Work
- https://w453y.me/education/: Education
- https://w453y.me/talks/: Talks
- https://w453y.me/about/: About
- https://w453y.me/rss.xml: RSS feed, full post content

## Writing

### Line-card BFD for plain Linux

Building a BFD offload whose fast path runs in XDP, from measuring the folklore about software BFD to a dual-stack engine with echo and multihop. Every claim backed by a packet capture. Starts with a primer if the terms are new.

- 2026-07-06, part 00: What all of this means
  https://w453y.me/writing/bfd-00-a-primer/
  A plain-language primer on the terms the rest of this series uses. BFD, FRR, XDP, eBPF, softirq, p99, and the rest. Read this first if any of those are new.
- 2026-07-06, part 01: Measuring the folklore
  https://w453y.me/writing/bfd-01-measuring-the-folklore/
  Everyone says software BFD cannot hold aggressive timers under load. Before building anything, I measured it. The number that should worry you is not the 970ms gap, it is the p99 sitting at 10.16ms in the same run.
- 2026-07-07, part 02: The folklore is partly wrong
  https://w453y.me/writing/bfd-02-the-folklore-is-partly-wrong/
  I wrote a 160-line BFD daemon expecting it to fail like bfdd did. It ran clean through the load that flapped bfdd 44 times. Userspace was never the problem as a category. The wakeup path was.
- 2026-07-07, part 03: The TX bake-off
  https://w453y.me/writing/bfd-03-the-tx-bakeoff/
  Five transmit architectures under identical RT starvation. The SO_TXTIME approach produced the best p99 of any backend tested and flapped 48 times, worse than doing nothing special at all.
- 2026-07-07, part 04: RX-clocked TX
  https://w453y.me/writing/bfd-04-rx-clocked-tx/
  XDP is an ingress hook. It cannot originate a packet. The way out is to stop trying: rewrite the packet the peer just sent you and bounce it back, so your transmit clock becomes the peer's transmit clock.
- 2026-07-07, part 05: Results, and putting FRR in the loop
  https://w453y.me/writing/bfd-05-results-and-putting-frr-in-the-loop/
  Zero flaps through the full stress ladder, one instructive exception that self-healed in 3.8ms, and an unmodified FRR driving the whole thing over its own dataplane protocol.
- 2026-07-12, part 06: Hardening, and a review that found real edges
  https://w453y.me/writing/bfd-06-hardening-and-a-review-pass/
  Session continuity across control-plane restarts, RFC 5880 validation, and an external code review whose two most annoying suggestions turned out to be genuine bugs.
- 2026-07-13, part 07: One session to sixty-four
  https://w453y.me/writing/bfd-07-multi-session-and-scale/
  The maps had been sized for 64 sessions since the beginning, and exactly one had ever been tested. Going to 64 found five bugs, one of them upstream, and the design's own false-flap boundary.
- 2026-07-18, part 08: IPv6, and the bake-off argument in miniature
  https://w453y.me/writing/bfd-08-ipv6/
  Dual-stack in five steps. The measurement that justifies the kernel reply runs both families on one box at the same instant, with the only variable being which side of the kernel boundary the transmit clock lives on.
- 2026-07-25, part 09: Echo mode, and instrumentation that cannot see its own failure
  https://w453y.me/writing/bfd-09-echo-mode/
  XDP cannot originate packets, so echo split along the line the hardware draws. Then the loss counter read zero through a 2.6 second stall, and both readings were correct.
- 2026-07-26, part 10: Multihop, and a test that validated nothing
  https://w453y.me/writing/bfd-10-multihop/
  One comparison changes from equals 255 to greater than a minimum. The TTL work passed all three cases and proved nothing, because the injector was sending to the wrong port.
- 2026-08-05, part 11: Every bug came from a capture, none from a log
  https://w453y.me/writing/bfd-11-every-bug-came-from-a-capture/
  Ten milestones, six upstream bug reports, and one method that survived all of it. Several of the bugs were introduced by the project's own tooling and design decisions, including ones I was confident about.

Series index: https://w453y.me/writing/series/line-card-bfd/

### Upstream bugs in FRR’s BFD daemon

Six bugs found while pointing an external dataplane at FRR, each written up from the issue and the fix. Buffer accounting, a transport that never worked, and two cases where the instrumentation agreed with the wrong answer.

- 2026-07-09, Two bytes of padding, and a transport that never worked
  https://w453y.me/writing/bfdd-unix-socket-einval/
  bfdd's UNIX socket dataplane transport failed every connect with EINVAL. The address was correct; the length was two bytes too long, and only AF_UNIX cares.
- 2026-07-15, How 8KB of buffer silently lost BFD sessions
  https://w453y.me/writing/bfdd-dataplane-buffer-overflow/
  A distributed-BFD dataplane registration burst overflowed an 8KB output buffer and stranded every session past the limit. Neither implementation owned them, and nothing logged it.
- 2026-07-17, Deleting sessions into a buffer nobody would flush
  https://w453y.me/writing/bfdd-shutdown-delete-messages-lost/
  On shutdown bfdd enqueues a delete for every dataplane session, then closes the socket and frees the buffer with the messages still in it. Fixing an earlier bug turned a total loss into a partial one, which was worse.
- 2026-07-18, A read of zero bytes that looked like a closed socket
  https://w453y.me/writing/bfdd-counters-teardown-zero-length-read/
  Running "show bfd peers counters" killed the dataplane connection on every other invocation. Two defects combined: consumed buffer space was never reclaimed, and a full buffer produced a zero-length read that was read as EOF.
- 2026-07-25, The RFC says negotiate, but nobody was listening
  https://w453y.me/writing/bfdd-echo-interval-negotiation/
  BFD echo packets must not be sent faster than the peer says it can receive them. For sessions handed to a dataplane, bfdd skipped that negotiation entirely and sent whatever was configured locally.
- 2026-08-03, Enabling echo mode took the session down
  https://w453y.me/writing/bfdd-ipv6-echo-source-address/
  A hardening fix made IPv6 echo reflection conditional on knowing the session. The sending side never chose its source address, so the guard rejected legitimate echoes and the session failed.

Series index: https://w453y.me/writing/series/frr-bfdd-bugs/

### Other posts

- 2025-09-17, Teaching an NGINX directive to take a variable, so my VPN could skip the login
  https://w453y.me/writing/nginx-auth-jwt-runtime-variable/
- 2025-04-15, The disk was fine, the page was not: a two minute smartctl and a GUI that gave up
  https://w453y.me/writing/proxmox-smart-usb-disk-hang/

## Projects

- xdp-bfd: line-card-style BFD offload for plain Linux, with the RFC 5880/5881 fast path in XDP. Parsing, liveness detection and transmission run in the kernel, so failure detection keeps its timing under CPU load that makes userspace BFD daemons flap: under SCHED_FIFO stress where FRR bfdd flapped continuously with transmit gaps to 960ms, the XDP path recorded 0 flaps and a 12.5ms maximum gap. Offloads sessions from an unmodified FRR bfdd over its distributed BFD dataplane protocol. Dual-stack, validated at a 64-session cap; RFC 5880 echo mode with an XDP reflector; RFC 5883 multihop. Every claim backed by a packet capture. https://github.com/w453y/xdp-bfd
- Self-hosted infrastructure: two-node Proxmox VE cluster with local ZFS plus a shared volume group on external block storage over four iSCSI paths with ALUA multipathing. OPNsense routes five segments with tagged VLANs and around 100 firewall rules, terminating WireGuard. One containerized NGINX reverse proxy fronts 30+ services with per-service vhosts and Let’s Encrypt via DNS validation, running a custom build carrying the JWT module contributed upstream. Layered DNS with internal and public Pi-hole instances behind three dnsdist frontends, DoH endpoints, DoT via stunnel, and unbound recursive. Around 25 workloads in production.
- Campus IPv6 deployment (APNIC-funded, NITK Surathkal): dual-stack SLAAC and DHCPv6 rollout across campus VLANs, DHCPv6 snooping, rogue-RA mitigation, RDNSS fixes for Android. https://apnic.foundation/projects/migrating-nitk-surathkal-campus-network-to-ipv6/
- Staging-Server (IRIS NITK): Django app deploying Dockerized apps to isolated staging environments with dynamic subdomains, live log viewer and a browser terminal. https://github.com/IRIS-NITK/Staging-Server
- ngx-http-auth-jwt-gateway: centralized JWT authentication gateway for NGINX with Google OAuth 2.0, group-based access control and hardened cookie policies. https://github.com/w453y/ngx-http-auth-jwt-gateway

## Open source contributions

- FRRouting, BFD daemon (bfdd): six bugs reported, each with a reproducer needing no dataplane implementation, all found while building xdp-bfd. Merged: #22645 (silent, permanent loss of BFD sessions when the initial dataplane registration overflowed the 8KB output buffer), #22805 (RFC 5880 s6.8.9 echo interval negotiation for offloaded sessions), #22621 (connect(2) failure making the dataplane client mode unusable over UNIX sockets). Open: #22692, #22694, #22920. https://github.com/FRRouting/frr/pulls?q=is%3Apr+author%3Aw453y
- TeslaGov/ngx-http-auth-jwt-module: PR #152, merged in v2.4.0. Runtime-variable support for auth_jwt_enabled, enabling conditional JWT enforcement and geo/map integration. Runs in production as the reverse proxy image on the self-hosted cluster.
- Proxmox VE, Bugzilla #6224: root-caused a GUI hang from blocking SMART queries on USB-attached SSDs, contributed diagnostics to the upstream timeout patch.

## Experience

### Firmware Engineer, Quantum Networks (Dec 2025 to present, remote)
- Verified boot in U-Boot for OpenWrt-based access points, with authenticated kernel and rootfs validation across dual-image flash layouts.
- Complete Qualcomm IPQ60xx secure-boot workflow: key provisioning, image signing, fuse programming, boot-chain verification from PBL to Linux.
- Hardened firmware-signing pipeline with RSA-PSS signing, SHA-384 fuse hashing, and signed recovery images.
- Low-level recovery over serial console, emergency download mode, and flash-level workflows.

### Intern, Tata Communications, Pune (May to Jul 2025)
- Multi-link WAN switching and aggregation engine with seamless failover across uplinks.
- Clustered virtualization on enterprise rack servers with redundant SAN storage over multipath I/O.
- Management, cluster and storage traffic isolated across dedicated interfaces and VLANs.

### Systems Engineer and Lead, IRIS NITK (May 2023 to May 2026)
- JWT access control for internal dashboards via a custom-compiled NGINX module integrated with Rails.
- Centralized monitoring with Zabbix and Grafana, alerting on certificate expiry, outages and anomalies.
- Migrated GitLab Enterprise to a containerized deployment, and 40+ containers and 15+ VMs to a high-availability cluster with zero downtime.

### Research Intern, NITK Surathkal (Apr to Jul 2024, supervisor: Prof. Mohit P. Tahiliani)
- Network access control testbed with PacketFence, OPNsense, 802.1X and VLAN segmentation.

## Talks

- Open Source Monitoring in Action (FOSS United Mangalore, Oct 2025)
- Introduction to Self-Hosting with Free and Open Source Tools (FOSS United Mangalore, Aug 2025)
- WAN Aggregation using OpenMPTCProuter (FOSS United Mangalore, Oct 2024)
- Securing IPv6 Networks with Firewalls (IIESoc workshop on IPv6 deployment, CSE, NITK Surathkal, Mar 2024)

## Certifications

- Oracle OCI Certified DevOps Professional (2025)
- Oracle OCI Certified Architect Associate (2025)
- Google Cybersecurity Professional Certificate (2023)

## Community

- Founder and moderator of r/dockerCE, a community-run Docker subreddit.
- Writes technical guides on Reddit as u/w453y (Proxmox cluster-to-standalone conversion, DNS over TLS for Pi-hole with stunnel). Active in r/Proxmox, r/selfhosted, r/homelab and r/pihole.
- Keybase-verified identity linking GitHub, Reddit, Twitter and Hacker News: https://keybase.io/w453y

## Skills

Network Engineering, Firmware Engineering, XDP, eBPF, Linux Kernel Networking, BFD, FRRouting, Routing Protocols, IPv6, OpenWrt, U-Boot, Qualcomm IPQ60xx, Secure Boot, Proxmox VE, Docker, NGINX, Self-Hosting, Open Source.
Also: BFD, RFC 5880/5881/5883, libbpf, C, Python, TypeScript, Lua, Shell, Django, Node.js, Zabbix, Grafana, Prometheus, Terraform, Ansible, ZFS, iSCSI, OPNsense, WireGuard, Pi-hole, dnsdist, AWS, GCP, Azure, OCI.

## Links

- Website: https://w453y.me
- https://github.com/w453y
- https://linkedin.com/in/w453y
- https://twitter.com/w453y
- https://instagram.com/w453y
- https://reddit.com/u/w453y
- https://t.me/w453y
- https://keybase.io/w453y
- Email: awasey8905@gmail.com